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[I*** 1 ] ?*fftft jca«i" « V^fi y^A^ot, 

2 ] M3«#^ft» % n T R u«f*k J: * WHtiftttC J: *) m^X 

M**3] * y * fc ^*«»Ka«i-*wHWflr««-e*or, 
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1- « ffri BBf *f tmn &n d MH^KUff t , 

s ] mmm^tmnwi, ma**>*u**su* u urns* ? *- 
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mum *&.j&-tz> mx&gt t , 

U 

0] mflltttt, NTRUWKUWrA'tfyXAKJ: 
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tie * sr * - v k -^tt« * * m t ritmmm * * at**^ y y fc 
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ft*« t tteib«sak«ift t tiff, * 7 - * mti-t *> m&x r ? 

ft 

BJfS^^f y n ^ ^ a (i , 

•ft 

z&trztzmwtti-zm^&mfur?;*,, 

[0 0 0 1] 
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^-v 5 : 



[0 0 0 2] 

[«<9&#r] 

* oT ^ S«t¥ft4NTRU»t3mBS*iTv»4 0 

S*fc**T*ft 0 NTRUWtt, »R*mktt«LT10-50*»a 
[0 0 0 3] 

U ft** *tfc*«»=tttB-^ttBft*lfc Iti 2 Hfttt*&jA 
[0 0 0 4] 
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[0 0 0 5] 

[*#BWtflR 1 ] 

Jeffrey Hoffstein, Jill Pipher and Joseph H.Silverman, "NTRU:A ring bas 
ed public key cryptosystem", Lecture Notes in Computer Science, 1423, pp 
. 267-288, Spr inger-Ver 1 ag, 1998 
[0 0 0 61 
Itfrttl] 

fcWIMHHW. 081, 597 
[0 0 0 7] 

#§32002-25261 l^m. 
[0 0 0 8] 

J. Proos, "Imperfect Decryption and an Attack on the NTRU Encryption 
Scheme", IACR ePrint Archive, 2003/002, http://eprint.iacr.org/, (2003). 
[0 0 0 9] 

imm^m^ l «t 9 1 -r % mm] 

[0 0 10] 

tfii ^^^ »*aMwrtt. m«^n/5A, 

[0 0 11] 

[ KJB * "t & tz tb <D ] 
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* * ~ ^ * /N * ^ t u 5 mvrn *it v L 
t**.***** y*-y*^jfiu mlt^i^ v*-v<7>m^?is*m 

[0 0 12] 

1. BftftS^v^T-A 1 0 

wmw-**?- a i o I*, iii i tc^i-j: ? k, -9— i o o tmm&m 
W2ootfrt>mmztn:i3i), v—jimmi oo 2 oott*, 

[0 0 1 3J 

* h 2 0 ^Lt, tfcftff£ltS2 0 0^#-t* o 0Mfcn^«S2 0 0lt H 
■^Mfca >-? > y Ik&m U Lfc«HWfc3 > ^ > y ^IfLtn > t- > y 
*U ^Ufc3>-r>y*s&U RflUV£K1K2 0 0 K1H*3*ltv>**- 

[0 0 14] 

1. 1 tw\*gf i o OOft 

■9— loon, in 2 tc^-r i ^ ^ ^ «iBtm ioi, mukim 1 0 

2. minimi 0 3, 0 4, m2Wki\Ml 0 5. ^^1 

0 6, MW10 7, 0 8KU<X^l 0 9*6«»S#ltv^ c 

tw^fiooii, *#fi5K»±, 70nynt,t, R OM, RAM, ^ 
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#12 0 0 3 - 1 6 7 3 7 4 ✓xf- *j . 

v Rett, ^>^3--?yuy7AtftmZtiT^Z> 0 

[0 0 15] 

( 1 ) it i o i 

«*IB*«t 1 0 1 14, H2K^tJ:^, ^HftEp, 3>f^;iKcJ0f 

&H«Kptt, NT R U^Oii^C J: ») i K s (**t 

+ *) *SfcLT^3*Lfc&H*-C*$, 2 6 3*5BONTRUlM-«)%fr»c 
, 1 8 4 1 If y h 

[0 0 16] 

(2) &«gaft«l 0 2 

SL£fc£j» 1 0 2 J4, 1 o 7 <D«fp©*fc, 6 4 If y Y (DftMR i co£ 

[0 0 17] 

(3) ftlflftflftl 0 3 

» i im» l 0 3 ii, l o 7 oMftegtc. flMMBM ioim 

iiK P s^>f>7iKc^iw e *i**fbtfi ostt, mm 

*10 7 0|WP©*^ JKTO«l (a) - ( C ) * 5 0* $ jg*. 

(a) 0 2 R i *S»t9l-5o 
[0 0 18] 

(b) ai*njLfc3>fv^KcawtwofcaftR i 

Kc I I R i 

(c) «Kp^V>T, ^f>7iKcOTtRi^A ( ^ L ^ 
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[0 0 19] 

EKc i=Enc 1 (Kp, Kc I I R i) 

n i J &&*m-rmtt'v& o , ^T^jxAEnc i 

*i* NTRUI|fl:U7WjXAT*!), X = Encl <Y, Z) tt, iY 
[0 0 2 0] 

-9 LT, 5Mfftn>f>7iEKc 1, EKc 2, • • - . EKc 5 

m 1 flWfc« 1 0 3 M\ fe^L7t 5^@OBt^bn >f^7iEK c 1 , 
EKc 2, • • EKc5t»$i»l0 6^t4o 

**fei$^gKSr^Lrv^ 0 1 BT^bSl 0 3 *ft7n y ^ (c^ 

« 1 0 5 t^trn y ^Kov»Tt W*T*4 0 JfaOHlirtCov'TtH* 

[0 0 2 1] 

(4) s^vi/sL^ 10 4 

^ y 5/*« 1 0 4 14, MM 1 0 7 ©Mf*oa?fc, flHMBttflS 1 0 1 a > 
H = H ash (K c) 

i:T% '^^■MashO-tltt, SHA-1W, fcfc, SHA- 
lfcov*Ttt % K9!»««^». ^ 7 ^fHtt 

> HO tfy hST?^^ 0 
[0 0 2 2] 



ttilE# 2004-3061063 



e 
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( 5 ) fjl 2 IS^-f bS8 1 0 5 

^T, K*ttiLfca>^^yc»3l«fl:T^rfi;XAEnc2t|fcfC, B^Ht 

[0 0 2 3] 

EC = En c 2 (Kc> C) 

»M:WijXAEnc2tt, FV^DESCU7;V^jXA 

m2m^mi o 5*4, ^Lfc^ta^>y E c*»*»*i o 

[0 0 2 4] 

(6) 0 6 

SMtfl 0 6 14, -f^* y >2 0tHt, RftfV£ltS2 0 0 2:«R 

1 0 6 (4, mmm 1 0 7 ©«|*<o*fc, « l l»4Hbffi l03H5fl 
OWfts^^iEKcl, EKc2, .... EKcS^f), 

f>7EC^(ttf), mofc5««»M3>f^iEKcl, EKc 
2x • • EKc 5, ^r>aiHSWft3^> 7Ec ^ -f^*-* 
"^2 0 £^LT, ft«>l¥^M2 0 0^^-f^o 
[0 0 2 5] 

(7) wni 0 7, a^i 0 sRimmui 0 9 

»S&10 7{4, fift^«10 2. »lt^k*l03, ;vr>^H4 
> «2flHKbff 1 0 sRtrasaMpi 0 6 *fflf|*-* 0 

»t^»*«r«fp«f 1 0 7^m^j-r^o 
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[0 0 2 6] 

mmui o 9*4, mmmi o 7e>mmv>mz, &m<Dmn*3m+& 0 

1 . 2 2 0 0 <7>*»/& 

WtS^««2 0 0tt, HSK^tJ:^, »M2 0 1, »1«««2 0 
2, ^y'/a«2 0 3, »2 0 4, flMKGtt«2 0 5, *2««2 0 6, 
ff^«2 0 7, Wnm 0 8, O 9XO^«2 l 0*?>*JM*ITV* 

[0 0 2 7] 

Wff^t2 0 0li, *-><*«10 0*ra*|c, 70nyot7t, R 
fctto TttfW* C * 0 , 2 0 0 (4, fO-«o«tttlftt 

o 

[0 0 2 8] 

(1) mm$w&&2 o 5 

6 3^5EONTRUB>^0»^»-tt. 4 1 5 If y HfC** 0 

(2) m^mu2 0 1 

»Mff2 0 1(4, h2 0^LT, t-^H0 0i:ii$ 

[0 0 2 9] 

»H«2oiii, auw2 0 8^jiofc 'f>^*7h2omt 

^tw^iioo^f,, 5«©»ffl:3>f^i EKcU EKc2, • • 
•, EKc5, ^ » 4 /afHX DWfca >f V y E C t*t« ^ , 3fcWRofc 
5«OHft 3 >f^iEKcl, EKc2, . . EKc5t»ia*» 
2 0 2^m^jL, *»t*o3fe^y^a«H*4|5g«2 0 4^(ti»U SWRofc 
^>f>7EC^2tf^2 0 6^ffi*1-* 0 
[0 0 3 0] 
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(3) tlIfH52 0 2 
* 1 *** 2 0 2 (i, tUffffi 2 0 8 *>«|*«>*fc % 2 0 1H5«O 

**fta>-r>y*EKc U EKc 2, .... EKc 5**WR<K Iff^ffi 
i»2 0 5H*WlK8*R*Hlt. «lft*tt2 0 2fi. |«2 0 

SOii^:, ttToJM (a) ~ (c) HBUDiSt. 
[0 0 3 1] 

(a) IMKs^t, Wft3>f^iEKc iKJtU, **T* 

DKc i =De c 1 (Ks, EKc i) 

«*7^>jXADec lfi, NTRUflf-^tCt^T^rrvXAT^ 
»K WftT^JXAEnc lK=*9^«**tfc«MW*«*f* 0 Z = De 
c 1 (Y, X) |±, mYtm^T, WiXKiJLtatT^rfyXADec 1 

[0 0 3 2] 

(c) a*«»^»B«|»$*tfe3>"3r>yftDKc i ^r>a^2 0 
teSB2 0 4-\ffi#-<}-& 0 

-9 LT, 5103^>?iDKc va.gB2 0 3£0«*W5&«2 0 

4^fcb#£ : n& 0 

[0 0 3 3] 

(4) ssy 2/jlSP2 0 3 
^y*A*2 0 3tt, «HP«2O8OM||0)SC > JKTOMI (a) - (b) 

(a) Hl^SP2 0 2^^n^f>7iDKc i ££»t#£ 0 

(b) ftWofta^vyftDKc i^U, ^r>«Hash« 
LT, ^r>aiH i *^-r*o 

[0 0 3 4] 

H i =H a s h (DK c i ) 
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*(c, ^***«2 0 314, ^L^7vaf H i *«£«2 0 4^***- 
(5) *!I£«B2 0 4 

H£«S2 0 4(4, «m«2 0 8 0M*4>£t= % &&mU2 0 lfrfc/Ny*** 
H*S»tJR»K ttT©«| (a) - (d) £ 5 !U££ 0 
[0 0 3 5] 

(a) ^y*/a»2 0 3^-r/atH i ££(tlfc£o 

(b) 01 2 0 2 ^^>f>7|DKc i £^(tIfc£o 

(c) Ar> a iHtA7->afH i fc#-StLTV»**5**«£-*-* 0 

(d) -afcLTv**»*fc, i<Oii:3>fV7iDKc i «W&W-lfrB 

[0 0 3 6] 

±SBO«| (a) ~ (b) O5H<0||&*L>WTUfc«, K*LTV*« io 
Wi&W-ltreitLTV^a^^yftDKc i ^2^2 0 6^ffi*U 

[0 0 3 7] 

(6) &2m^M2 0 6 
i2ffg2 0 6li, $IJ«2 0 8(Oi|loil:, ipjjtgfl 2 0 4 * & a > 
7iDKc i a»ft«2 0 lHWHfc 3 >t^y E C«ltJR9 

[0 0 3 8] 

*2«*«2 0 6(4, 4«Lfc3>f ^Ctffife*2 0 7^ffi£1-£ 
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(7) ??±S&2 0 7 

S^«J2 0 7tt, fHia52 0 8^W^;, *2&W 2 0 6 *fe a >-f > 
?C ****** mofea^^ctffiU, 

o^m#i-£ 0 

[0 0 3 9] 

(8) m®U2 0 8, A2HH52 0 9RV3mU2 1 0 

«*«2 0 8I2. »M«2 0 1, »1«^»2 0 2, ^,y^2 0 3, *lj 
^ff 2 0 4, %2Wm2 0 6X0»S:^aJ2 0 7 *«#H-* 0 
«Wff2 0 8tt, «5&«2 0 4*^ WWb3>^>y«0«WjEL<ff*> 

[0 0 4 0] 

jEL<ff*>*L**o)t:»t*ftl*|| f « ftltw<B4: ^ *2«9tt2 
[0 0 4 1] 

A^7^2 0 9*4, AftTV^kik«2 0 0Oflffl#*£>*fi^*£itft»t. $»t 

#*t^Jt^*«»iaj2 o 8^m2jir-&o 
*^«2 1 of*. fij®^2 0 8<r>wm<o&z, &m<7>mmzmmtz 0 

[0 0 4 2] 

(1) t-A*tf i-oooi^ 

*l«Wb*l 0 3li, flHMBttflffl 0lH3^^iKct«*BL 
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16/ 



Urv7S 10 1), ^F^Kp^^mi" (7f;rs 1 0 2) 0 

[0 0 4 3] 

Pim&l 0 7(i, Xf'^S 103-S10 6&C;fev>T, ^ry^S 1 
0 4-S 1 0 5*5H*9£?i:3£MfH-« e fcib\ JaTKB*©ft»R i x 

•9-7* *0*Lfc*v»T, i = 2, 3, 4, 5©J:*|c*ffc1- 

[0 0 4 4] 

SLftSUfettl 0 2 14, 6 4 If y boa»R i ££j£U &jALttSLftR i *$ 
1*M5»10 3^IB*L Uf^S10 4) , *nm«5103tt, a > 
f>7iKcTOSRi^U «Kp^v>t, n>f>7iKcS 
Wr 1 ^t^LT, ^T^'jXAEn c 1 £*feLT, «HHk3> 
^^iEKc i Srfejfti-* Uf'^S 105), 
[0 0 4 5] 

^^CLUf^S 1 04^f«^S 1 0 5 iW50il)jiH 
^^^^^ 5iOim3^^ftEKcl, EKc2, • • EKc 

a s hSrifcLT, ^r/afHiijStS Ufy7*S10 7) 0 
[0 0 4 6] 

* 2 MB 1 0 5 (4, flMHBIIff 10 1H3VWiKc 
tbt Ut'^S10 8) , 3>^>yC*tt*fflL (Xx*rs 109) , i 
^UaVfV^KcifflK, ffi^m L£ =7 > r > y C JCBUHbT ^ 
XAEnc 2£MLT, H^fta^fVyEC^t-S Uf-^Sl 1 0) 

o 

[0 0 4 7] 

1 0 6 (4, 510Hfj^>f>7iEKcl, EKc2, • 
• •> EKc5, ^•r>aiHSWftn>f>7ECt 



ffifE# 2004-3061063 



#H2 003-167374 



OSrfrLT, WIS^t2 0 O^fii-* Uf-^S 1 1 1) 0 

( 2 ) mmtkmm 200 o»f^ 

[0 0 4 8] 

IO»tft=>r^|EKcl, EKc2, • • EKc5, ,^v^H 

Kc 1, EKc2, • • EKc5t»iaf«2 0 2^U SWRofc 
^ y v^-fitH 2 0 4 ^{U7J U *»t*o fcflHWfca ^>7ECt#2 
«-f-«B2 0 6^tb7Jt-^ (KT-vfS 1 3 1) o 
[0 0 4 91 

*l«**2 0 2tt, flWtSB«»2 0 5^?>««B|Ks*tt*W-r Ur-^ 
SI 32) G *fc % MH«2 0 8a, ^f^Sl3 3-S13 9i:^T, X 
t^S 1 3 4~S 1 3 8 *5H**StJ:} KM*-*-*, ft*, jeiT©«HHfc 

* TiJ tt, «»?«L«>#|Hlt^-9-7-f *fcO«U;:*v»T, i = 

1> 2, 3, 4, 5 0J:-9Jc^k-t-*feO-e*& 0 
[0 0 5 0] 

U,«^tfyXADecimT, =>WftDKc i *4«L (X 
34) , 4^U:3>f>7iDKc *Ji06 4e 

^S&2 0 3M«2 0 4^tB7J-f* Ufyrs 1 3 5) 0 
[0 0 5 1] 

^r>ag|!2 0 3tt, mi^U2 0 2H3>f^iDKc i £^ 

LT, ^-r>aiH i Uf-^S 1 3 6) 0 

«5fe»2 0 4tt, ^7yaSf2 0 3HA. r >afHi^^ ^ 
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1**«2 0 2Hn>fV7iDKc i A r >afi H ^>r>a 
«H i fc#^LTV***5***£ L (Xf^S 13 7), -tLTV»4» 

Uf^S13 7) , iOiiOiO|fc3^>-; iDKc 
tttfTMmtZ Uf77"S 1 3 8) o 
[0 0 5 2] 

*#**u* Uf.ys i4o). im 3 ^>7toa^ L <fffc*ifc 

feOfc^WfU t2(|«»2 0 6tt, «t«2 0 4H3>f>7iDKc i* 

>f>7iDKc $ WofcgHWfca E C K(lt7 A^rfy 

XADe c 2£*&LT, ^/f>7C^L Utv^S 14 1), #&*&2 
0 7(i, »2««J2 0 6^fe3>^>y C **»t«5, mofca>f^ 

[0 0 5 3] 

K*LTV^io|t**»»t*Ltir (Xf-^SHO) , »2 0 4(i, 5 fl 
***«-*r**W*»2 0 8^m#L, M*«*2 0 8 14, *2ft*«2 0 6 

««m«j#pu «^«2 1 oii, m^-tmm-r* Ur^s 143 

) o 

[0 0 5 4] 

±Bfc*v>T, 2 0 8 (2, ^ysi3 3-S13 9Wv»T 

^^S134-S138*5 Hft*«- J: * KHWt4 ITV^^, * 

S£**i;fc**fc, ^f^S 134-S13 S^^mtLTUv^ 
1. 4 ifcafr 

^^^^ ±eo»o»«Ti*, ^*~>* m (utto^ai-ca 
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[0 0 5 5J 

mmmmx^ v-^mm) a, mri-rs^u mi 

I Rl, ml | R2, ml I R3, ml | R4Mm| | R5«U ^tt-T 
WWftLTEn « (ml I R 1 ) , Enc (ml I R2) , Enc (ml | 
R3) , Enc (ml | R4) RVE n c (ml I R 5 ) &£j£1-* 0 iCT% 
Enc (X) t±, ^XtCBf^bT^^UXAEnc^MLTBt^^^-t-^ 
-t^Uv^ D ^ ^-r>a| H ( m ) ^lt#-f^ 0 Enc (m I 

1 Rl) , Enc (ml I R2) , Enc (ml I R 3) , Enc (ml I R4 
) > Enc (m| | R 5) S^.yafH (m) *%mmW. (HifcO^JBlTIi 

[0 0 5 6] 

3«*«tt, Enc (ml |R1) N Enc (ml I R2) , Enc (ml I 
R3) . Enc (ml | R4) , Enc (ml | R5) M^^yafH (m) 
*5HiU Enc (ml IR1) , Enc (ml |R2) , Enc (ml |R3 
) > Enc (ml | R4) , Enc (ml | R5) *«*LT, 
itWm1 ^ ' * ^mitSo Sfcfc, m i, . . ffl5 ^, 
***H (ml), . % H (m 5) tft»L, ^^tiff* Lfc^ y v^H 
^il^r/afH (m) ZeOMUZ^X. 

v^fH (m) lat^^i 

-^^^^va-m^is-r^^^-t-y (mi, .... m5m » fn 

[0 0 5 7] 

2 6 3*5BONTRUWWv»r, ^loio^fi7-^> t 
T% 1 0-25 (= io-5xi 0-5x 1 0~5 X 1 0"5 
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XI 0-5) mmt%2> 0 1 0 2 4 tfy b©RSAI**0*frfcj3»t*** 

AMP**. 2-80= 1 0-24^**. 2 6 3^NTRU^ 

V»T, ±B©SOfc©»**»BLfc**fcWU 1 0 2 4 fcf y M9RSA«fO* 

[0 0 5 8] 

2. -eofecO^f^J 

^ > y « * 5 IjSftt *tLtv>*^ a ^ > y ft Bf^k L Tfejft L fctffl: 
[0 0 5 9] 

[0 0 6 0] 

(3) ±E0«t03B»tli, ^bSfti^-b-ymt^^^ 
* y * - vm L T $ (C^Ottff *M L T , ftfftt* tWHit a JfrfrfMcft 

mti£, mmmwit, sv^-vm^ roj . ru , r2j, r3j &v 

r4j **tl*tita*LX TmJ , Tm+lJ, rm+2j, rm+3Jatf 
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Enc (ml IR1), Enc (m+ 1 | | R 2 ) , Enc (m+ 2 I I R3) 

, Enc (m+3 I | R4) , Enc (m+4 | | R5) 
10 0 6 1] 

Enc (ml I Rl) , Enc (m+1 | | R2) , Enc (m 
+ 2 I.I R3) , Enc (m+3 I I R 4), Enc (m+4 I I R5) 

i^m^?,, roj, n j . r 2 j, rsjMr4jH^ti 

[0 0 6 2] 

^ it:LtUvi ° Sit^7^y mi :R ©AS* L 

[0 0 6 3] 

(5) ±CO*l|®g»Cf2, ^^^yf^Lt, 5j@ 

[0 0 6 4] 

(6) WIMy^M OJi, ^S£««2 0 0fcft*.T, HB7H^* 
RH4MRR2 0 0 bX^*y#- K3 0 0 b **trb LrtiK 
M»§tC2 OObil, Rftff^ttC2 0 0 y * 

- K3 0 0 btt, ftRff&BS2 0 0OflSO-«o«|t«it4 o 
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o * »k ^ * u * - k 3 o o b *±, f uffl^tc i o mm&mm 2 0 0 b 

t>7i5:W|^t2 0 0 b^(tt*-J-* 0 ftft¥f&*«2 OObtt, 
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